Privacy Policy

1. Overview

ReviewReply Enterprise ("we", "us", "our") operates a review management platform that helps businesses aggregate, respond to, and analyze customer reviews across multiple platforms. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws. By using our services, you consent to the practices described in this policy.

2. Information We Collect

2.1 Information You Provide

• Account information: Name, email address, password (hashed), and business details when you sign up.
• Business profile: Business name, address, phone number, industry, timezone, and integration credentials (OAuth tokens stored encrypted).
• Customer data: When you send review requests, we process customer names and contact information (phone, email) to deliver SMS/email on your behalf.
• Communication: Any emails, support tickets, or feedback you send us.

2.2 Information We Collect Automatically

• Usage data: IP address, browser type, device information, pages visited, time spent, and click patterns.
• Review data: Reviews fetched from connected platforms (Google Business Profile, Facebook Pages, Yelp, Trustpilot) on your behalf.
• Cookies and similar technologies: Session cookies for authentication, analytics cookies for product improvement.

3. How We Use Your Information

• Service delivery: To provide the review management platform, including fetching reviews, generating AI draft replies, sending review requests, and displaying analytics.
• Authentication: To verify your identity and manage your account session.
• Communication: To send you service-related notifications (e.g., new reviews, trial expiration), product updates, and support responses.
• Improvement: To analyze usage patterns, improve our features, develop new functionality, and troubleshoot issues.
• Security: To detect and prevent fraud, abuse, and unauthorized access to our platform.
• Compliance: To comply with legal obligations and protect our legal rights.

4. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

• Contractual necessity: To provide the services you requested under our Terms of Service.
• Legitimate interests: To improve our services, ensure security, and prevent fraud, balanced against your privacy rights.
• Consent: For non-essential cookies, marketing communications, and certain data processing activities.
• Legal obligation: To comply with applicable laws, such as tax records and audit requirements.

5. Data Sharing and Disclosure

We do not sell your personal data. We share information with the following categories of recipients:

• Service providers: Sub-processors who help us deliver the service (hosting, email delivery, SMS, payments, analytics). A full list is available in our Sub-processor Register.
• Review platforms: Google, Facebook, Yelp, and Trustpilot when you connect your accounts via OAuth and we fetch or post reviews on your behalf.
• Legal authorities: When required by law, court order, or to protect our rights, property, or safety.
• Business transfers: In connection with a merger, acquisition, or asset sale, with notice to you.

6. Data Retention

We retain your data for the following periods:

• Account data: Until you delete your account, after which we retain data for 30 days for recovery, then permanently delete it.
• Customer contact info (PII): 90 days after the last review request, then automatically purged.
• Reviews and replies: Until account deletion.
• Audit logs: 7 years for SOC2 and legal compliance.
• AI draft history: 1 year for brand voice training and quality improvement.

7. Your Rights

Under GDPR and CCPA, you have the following rights:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Limit our processing of your data in certain circumstances.
• Portability: Receive your data in a machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Withdraw consent for consent-based processing at any time.

To exercise these rights, visit Settings → Compliance → GDPR, or email privacy@reviewreply.com. We respond within 30 days.

8. Data Security

We implement industry-standard security measures to protect your data:

• AES-256-GCM encryption for PII at rest, with KMS-managed keys.
• TLS 1.3 for data in transit.
• Row-Level Security (RLS) in our database for tenant isolation.
• OAuth 2.0 for third-party integrations — we never store passwords.
• SOC2 Type II controls (audit in progress).
• Regular penetration testing and security reviews.
• Audit logging of all write operations, retained 7 years.

9. International Data Transfers

Your data may be processed in the United States (default) or the European Union (for Enterprise customers who request EU data residency). We use Standard Contractual Clauses (SCCs) for international transfers and have implemented supplementary measures to ensure an adequate level of protection.

10. Cookies

We use the following categories of cookies:

• Essential: Required for the site to function (authentication, security).
• Analytics: Help us understand how the product is used (anonymized).
• Marketing: Used for retargeting (opt-in only).

You can manage cookie preferences via the consent banner or in Settings → Compliance → GDPR.

11. Children's Privacy

Our services are not directed to children under 16, and we do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email and post a notice in the app 30 days before the changes take effect. The "Last updated" date at the top reflects the most recent revision.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact:

• Data Protection Officer: dpo@reviewreply.com
• General inquiries: privacy@reviewreply.com
• Postal address: ReviewReply Enterprise, Attn: Privacy, 100 Market Street, San Francisco, CA 94102